auction-research

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill searches and retrieves auction and lot details from Bonhams via the Crawlora API, which returns outsider-authored catalog descriptions and footnotes that the agent reads dynamically at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill makes runtime API requests to api.crawlora.net, which is an external third-party service provider acting as a commercial data aggregator rather than an official publisher of the targeted auction house domain (bonhams.com), placing it in the common/reputable unofficial tier.